DBS Checks for Employers: Levels, Eligibility, Rechecks and Storage

A DBS check tells you what the Disclosure and Barring Service held about a person on the day the certificate was issued. Ordering one is a few forms. Knowing which level you are allowed to ask for, what you can keep afterwards, and when to check again is where employers go wrong.

This post covers the four levels, who can ask for each, current fees, rechecks and the Update Service, how to handle the certificate, and how to track it in WorkZerk. It covers England and Wales. Scotland and Northern Ireland have their own schemes, covered briefly below.

The four levels of check

There are four levels. Each one shows more than the one before it (GOV.UK: DBS checks).

Level	What it shows	Fee
Basic	Unspent convictions and conditional cautions	£20
Standard	Spent and unspent convictions and cautions, except those filtered out	£20
Enhanced	Everything on a standard check, plus relevant information held by local police	£41
Enhanced with barred lists	Everything on an enhanced check, plus whether the person is on the children's or adults' barred list	£41

These fees took effect on 5 October 2026. Before that, basic and standard checks cost £21.50 and enhanced checks £49.50 (DBS fee reduction). The organisation that processes the check for you may add its own admin fee on top.

Who is eligible for which level

A basic check is available for any role. Anything above that depends on the job.

A standard check is only for roles covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. Normally a spent conviction does not have to be disclosed under the Rehabilitation of Offenders Act 1974. The Exceptions Order lists the roles where an employer can ask the "exempted question" anyway, such as solicitors and accountants on entry to the profession, court staff, prison officers and some senior financial roles (eligibility for standard checks).

An enhanced check needs the role to be covered by the Police Act 1997 and its regulations as well (DBS eligibility guidance). Most are roles working with children or adults who need care.

A barred list check is only for people doing regulated activity, defined in Schedule 4 of the Safeguarding Vulnerable Groups Act 2006. It is an offence to let someone do a regulated activity they are barred from if you know or have reason to believe they are barred (section 9).

Getting the level right is your job. DBS says that "knowingly requesting a higher-level check than the legislation allows is unlawful" and may breach the Data Protection Act 2018 (DBS guidance for employers). The legislation makes checks possible, not compulsory: whether you need one is your decision, unless your sector's rules say otherwise. If you are unsure, use the DBS eligibility tool.

Who can apply

You do not apply to DBS directly for most checks.

• Basic: use a DBS registered responsible organisation. It runs the check and tells you the outcome. It takes up to 14 days (basic checks).
• Standard and enhanced: if you ask for fewer than 100 checks a year, you must use an umbrella body. At 100 or more, you can register with DBS yourself. These usually take around 8 weeks (standard and enhanced checks).

The person fills in the application and proves their identity. The certificate is posted to them, not to you, and they show it to you. DBS says employers "must ensure they see an original DBS certificate".

Self-employed people and personal employees request their own check. More on contractors in the UK contractor onboarding checklist.

Free checks for volunteers

Standard and enhanced checks, with or without barred lists, are free for volunteers. A volunteer is someone spending time, unpaid, doing something that benefits someone other than, or as well as, a close relative. They must not be paid beyond travel and out-of-pocket expenses, be on a work placement, or be a trainee on a course leading to a job or qualification (DBS: volunteers). Basic checks are not free: volunteers pay £20 like everyone else.

How long a certificate lasts

It doesn't expire. DBS says: "There is no official expiry date for a criminal record check issued by DBS" (guidance for employers). It shows what was known on the issue date, and nothing after it.

So you set the recheck period. Some sectors set one for you. Otherwise write your own, such as every three years for anyone working with children, and apply it consistently. Accepting a certificate someone got for a previous job is also your call. Check the issue date, and that the level and workforce match your role.

The DBS Update Service

The Update Service lets a person keep their standard or enhanced certificate current and reuse it. It is not available for basic checks.

• The person subscribes, within 30 days of the certificate being issued. It costs £15 a year (it was £16 until 5 October 2026), and it is free for volunteers.
• With their consent, you can run a free status check online. You do not need to register or pay.
• You must see the original certificate first. DBS says copies, or viewing it over a video link, are not enough.
• The result says the certificate is still current, or that it is "no longer current". If it is no longer current, you need a new check to see what changed.
• DBS will not tell you if the status changes, so check at intervals that suit your policy. There is no set frequency.
• Stop checking when the person leaves, moves to a role that isn't eligible, or withdraws consent.

All of this is from the Update Service employer guide.

Handling and storing the certificate

Registered bodies, and anyone using DBS checks through them, must follow the DBS code of practice. It says to use certificate information only for the purpose it was asked for, and fairly.

DBS's sample policy on handling certificate information sets out the detail:

• Limit access to people who need it, and record who it was shown to.
• Keep it no longer than necessary after your decision. DBS's employer guidance says "usually no longer than 6 months".
• Don't keep a photocopy or image of the certificate.
• You may keep a record of the issue date, the person's name, the type of certificate, the position it was for, its reference number, and your decision.

Criminal record information is also criminal offence data under Article 10 of the UK GDPR. As well as a lawful basis, you need a condition from Schedule 1 of the Data Protection Act 2018, and some conditions need an appropriate policy document. The ICO's criminal offence data guidance on ico.org.uk explains each condition.

Scotland and Northern Ireland

DBS covers England and Wales. In Scotland, checks come from Disclosure Scotland, and anyone doing a regulated role with children or protected adults must join the Protecting Vulnerable Groups (PVG) scheme. In Northern Ireland, checks come from AccessNI, which has its own basic, standard and enhanced checks.

The rules change and depend on your sector, so this is general information, not legal advice. Check with DBS, your umbrella body or a solicitor. For the rest of the paperwork, see right to work checks and the UK new starter checklist.

What WorkZerk does and doesn't do

WorkZerk keeps the record side of a DBS check in one place:

• Each person can upload their certificate from a private link, with no account or password.
• Marked sensitive, a file or field is stored encrypted and only admins can see it.
• You approve each upload, and WorkZerk records who approved it and when.
• WorkZerk emails the person before their recheck date.
• The Document compliance report shows who is current, due or missing a check.
• WorkZerk can delete an approved file a set number of days after you approve it, keeping the date and your approval.

What it doesn't do: WorkZerk does not apply for DBS checks, act as an umbrella body or responsible organisation, run Update Service status checks, or check that a certificate is genuine. A photo uploaded to WorkZerk is a copy, so it is not the original certificate DBS says you must see. Those steps stay with you.

Setting it up in WorkZerk

1. Turn on two-factor authentication

Asking people to upload documents needs two-factor authentication on your account. Set it up under Account, then Two-factor authentication (opens in WorkZerk in a new tab).

2. Add the UK staff pack

Open Requests (opens in WorkZerk in a new tab), click Request packs, open Start from a template and pick the United Kingdom. Click Add this pack on Staff onboarding (United Kingdom).

It includes an optional DBS certificate upload, described as "Only if your role needs a DBS check." It saves to a DBS certificate field on the contact, already marked sensitive. See starter request packs.

3. Give the certificate a recheck date

A DBS certificate prints no expiry date. In WorkZerk, use the expiry date as your recheck date. That date drives the reminders and the compliance report.

Open Fields (opens in WorkZerk in a new tab) and open DBS certificate. Switch on Require an expiry date, and switch off Use AI to check expiry date, because there is no printed date for it to read. See keeping sensitive information private for what the Sensitive setting changes.

Then add the fields DBS allows you to keep:

• DBS certificate number, a Text field, marked sensitive.
• DBS issued on, a Date field.
• DBS check level, a Text field, for basic, standard, enhanced or enhanced with barred lists.

4. Ask for it on a portal

Open Portals (opens in WorkZerk in a new tab) and create one for the role or intake. On its Requests panel, click Add pack and choose your copy of the UK staff pack. On the DBS certificate ask, tick Require expiry.

Spell out the date in the description, for example: "Upload a photo of your DBS certificate. In the expiry date box, enter the date three years after the issue date. Bring the original on your first day." Add a Fields request for the certificate number, issue date and level, and say why the role needs a check.

5. See the original, then approve

Uploads wait under Needs review on Requests (opens in WorkZerk in a new tab). Compare the upload with the original certificate. If the recheck date is wrong, click Change date and correct it before you approve. See reviewing uploads.

6. Delete the copy after you approve it

DBS's sample policy says not to keep an image of the certificate. Open Profile (opens in WorkZerk in a new tab) and find Document retention. Under Delete approved files, pick 7 days after I approve them. WorkZerk then deletes the file and keeps the recheck date, who sent it and your approval. The certificate number, issue date and level stay in their own fields.

The setting applies to every approved file with an expiry date in your account, not just DBS certificates, and only from your next approval. See deleting documents after you approve them.

7. Switch on the reminders

Open Automations (opens in WorkZerk in a new tab) and switch on Document expiring reminder and Document expired reminder. Both start switched off. The expiring reminder goes 30 days before the date by default. An enhanced check usually takes around 8 weeks, so consider 90 days. See automations.

8. Check who is covered

Open Requests (opens in WorkZerk in a new tab) and click Document compliance. Each person shows as current, expiring, needs review, expired or missing for their DBS certificate. Use Download CSV when an auditor or funder asks for a register. See document compliance.

Getting started

Start a free WorkZerk trial at workzerk.com and add the UK staff pack. If you get stuck, the getting started guide walks through a first portal end to end, or email us at [email protected].